HackingFinancial ServicesFinanceVulnerability ExploitCapture Stored DataData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

ON Q FINANCIAL, LLC

bd_bfba92634c81bbdc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 14, 2023

Filed

Apr 2, 2024

To disclose

13 months

Affected

132state residents only

Linked

14 filings

Confidence

66%

Full breach record for ON Q FINANCIAL, LLC →2 incidents on file

On Q Financial, LLC notified clients of a data security incident involving the ConnectWise ScreenConnect vulnerability. An unknown individual accessed the network and exfiltrated client names and Social Security numbers. The company patched the vulnerability, engaged forensic investigators, reported to the FBI, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 months / 385 days

Mar 14, 2023

Discovered

Apr 2, 2024

Filed

vs. sector median

+46 wks slower

This filing is one of 14 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitebianlianbd_ee592bde892a7b022024-04-06 · +4dVerified by operator

Regulatory filings (9) · sorted by filing gap

Washington State AGbd_32dae1ae6ad3e6f42024-04-02Candidate
California State AGbd_47866e35155e8f932024-04-02Verified by operator
Maine State AGbd_70331c336a1897252024-04-02Verified by operator
South Carolina State AGbd_5fb90898a6e95a8e2024-04-03 · +1dVerified

Show 5 more filings ↓up to 9d gap

New Hampshire State AGbd_a5faead4f3404bf82024-04-03 · +1dVerified by operator
Massachusetts State AGbd_d4ea7af3e6261a2d2024-04-03 · +1dVerified
Illinois State AGbd_bca121f6a23d98442024-04-01 · +1dVerified by operator
Indiana State AGbd_195d1d831b9193992024-03-29 · +4dVerified by operator
Oregon State AGbd_b11839235c04d95c2024-04-11 · +9dVerified

Showing first 10 of 13 linked disclosures.

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com
Industry: Financial Servicesllm

Discovered: Mar 14, 2023
Materiality determined: —
Notification sent: Mar 29, 2024
Affected individuals: 132state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported this incident to the FBI
Initial access: exploit_public_facing

During the incident: Patched and upgraded the application
Engaged a computer forensics investigation firm
Reported this incident to the FBI
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Changes made: Implemented additional measures to enhance the security of our network environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(385 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Indiana State AGMar 29 · first

Illinois State AG+3d

Washington State AG+4d

California State AG+4d

Maine State AG+4d

Montana State AG+4d · this page

South Carolina State AG+5d

New Hampshire State AG+5d

Massachusetts State AG+5d

Oregon State AG+13d

Pattern: first filing Mar 29 (IN), last Apr 11 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1261.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2024
Raw hash: 09b14def99b922c8df30697e499fd2b0b4eed55fceafc6def12bbb3cfa247530

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityON Q FINANCIAL, LLC

Victim entityON Q FINANCIAL, LLC

Incidentdiscovered Mar 14, 2023

Stated responsePatched and upgraded the application

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov